X-Git-Url: https://iankelling.org/git/?p=distro-setup;a=blobdiff_plain;f=mail-setup;h=fdb4c219d4eb2b9154c500c93fe6d751fe962113;hp=70a15a26d277418dc0edee13612be3b95a3d8438;hb=f7a2fe0e56e14b55818245a2e3a2eb68f1cd23de;hpb=f5c8ee56b55b90298b48c83ed0f7ec98cce96bb5 diff --git a/mail-setup b/mail-setup index 70a15a2..fdb4c21 100755 --- a/mail-setup +++ b/mail-setup @@ -1,4 +1,6 @@ #!/bin/bash +set -x + # Copyright (C) 2016 Ian Kelling # Licensed under the Apache License, Version 2.0 (the "License"); @@ -25,6 +27,13 @@ Setup exim4 / postfix / dovecot The minimal assumption we have is that /etc/mailpass exists + +I\'ve had problems with postfix on debian: +on stretch, a startup ordering issue caused all mail to fail. +postfix changed defaults to only use ipv6 dns, causing all my mail to fail. +I haven\'t gotten around to getting a non-debian exim +setup. + -h|--help Print help and exit. EOF exit $1 @@ -108,13 +117,14 @@ u=$SUDO_USER # # host -t txt _dmarc.gmail.com # # yahoo: p=reject, hotmail: p=none, gmail: p=none, fastmail none for legacy reasons # # there were articles claiming gmail would be changing -# # to p=reject, in early 2017, which didn't happen. I see no sources on them. It's +# # to p=reject, in early 2017, which didn\'t happen. I see no sources on them. It\'s # # expected to cause problems # # with a few old mailing lists, copying theirs for now. # # echo "dmarc dns, name: _dmarc value: v=DMARC1; p=none; rua=mailto:mailauth-reports@$domain" # # 2017-02 spf policies: +# # host -t txt lists.fedoraproject.org # # google ~all, hotmail -all, yahoo: ?all, fastmail ?all # # i include fastmail\'s settings, per their instructions, # # and follow their policy. In mail in a box, or similar instructions, @@ -253,7 +263,7 @@ smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt inet_protocols = ipv4 EOF # msg_size_limit: I ran into a log file not sending cuz of size. double from 10 to 20 meg limit - # inet_protocols: without this, I've had postfix try an ipv6 lookup then gives + # inet_protocols: without this, I\'ve had postfix try an ipv6 lookup then gives # up and fail forever. snippet from syslog: type=AAAA: Host not found, try again @@ -343,6 +353,12 @@ EOF # most of these settings get translated into settings # in /etc/exim4/update-exim4.conf.conf + # how /etc/exim4/update-exim4.conf.conf translates into actual exim settings is + # documented in man update-exim4.conf, which outputs to the config that + # exim actually reads. except the man page is not perfect, for example, + # it doesn't document that it sets + # DCconfig_${dc_eximconfig_configtype}" "1" + # which is a line from update-exim4.conf, which is a relatively short bash script. # mailname setting sets /etc/mailname debconf-set-selections <$f <<'EOF' +set -eE -o pipefail +trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR + +[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@" + +f=/a/bin/bash_unpublished/source-semi-priv +if [[ -e $f ]]; then + source $f +fi +if [[ $HOSTNAME == $MAIL_HOST ]]; then + local_mx=mail.iankelling.org + rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li:/etc/letsencrypt/live/$local_mx/" + ${rsync_common}fullchain.pem /etc/exim4/exim.crt + ${rsync_common}privkey.pem /etc/exim4/exim.key +fi +EOF + chmod 755 $f + + cat >/etc/systemd/system/mailcert.service <<'EOF' +[Unit] +Description=Mail cert rsync +After=multi-user.target + +[Service] +Type=oneshot +ExecStart=/a/bin/log-quiet/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron +EOF + + cat >/etc/systemd/system/mailcert.timer <<'EOF' +[Unit] +Description=Run mail-cert once a day + +[Timer] +OnCalendar=daily + +[Install] +WantedBy=timers.target +EOF + systemctl daemon-reload + systemctl start mailcert + systemctl restart mailcert.timer + systemctl enable mailcert.timer + + ##### end mailcert setup ##### + + + if [[ $HOSTNAME == $MAIL_HOST ]]; then debconf-set-selections </etc/dovecot/conf.d/20-lmtp.conf <<'EOF' + cat >/etc/dovecot/conf.d/20-lmtp.conf </etc/systemd/system/spamddnsfix.timer <<'EOF' [Unit] @@ -700,53 +786,6 @@ EOF ##### end spamassassin config - f=/usr/local/bin/mail-cert-cron - cat >$f <<'EOF' -set -eE -o pipefail -trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR - -[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@" - -f=/a/bin/bash_unpublished/source-semi-priv -if [[ -e $f ]]; then - source $f -fi -if [[ $HOSTNAME == $MAIL_HOST ]]; then - local_mx=mail.iankelling.org - rsync_common="rsync -ogtL --chown=root:Debian-exim --chmod=640 root@li:/etc/letsencrypt/live/$local_mx/" - ${rsync_common}fullchain.pem /etc/exim4/exim.crt - ${rsync_common}privkey.pem /etc/exim4/exim.key -fi -EOF - chmod 755 $f - - cat >/etc/systemd/system/mailcert.service <<'EOF' -[Unit] -Description=Mail cert rsync -After=multi-user.target - -[Service] -Type=oneshot -ExecStart=/a/bin/log-quiet/sysd-mail-once mailcert /usr/local/bin/mail-cert-cron -EOF - - cat >/etc/systemd/system/mailcert.timer <<'EOF' -[Unit] -Description=Run mail-cert once a day - -[Timer] -OnCalendar=daily - -[Install] -WantedBy=timers.target -EOF - systemctl daemon-reload - systemctl start mailcert - systemctl restart mailcert.timer - systemctl enable mailcert.timer - - - @@ -819,6 +858,28 @@ dovecot_lmtp: batch_max = 200 EOF + cat >/etc/exim4/conf.d/router/190_exim4-config_fsfsmarthost <<'EOF' +# smarthost for fsf mail +# ian: copied from /etc/exim4/conf.d/router/200_exim4-config_primary, and added senders = and +# replaced DCsmarthost with mail.fsf.org +fsfsmarthost: + debug_print = "R: smarthost for $local_part@$domain" + driver = manualroute + domains = ! +local_domains + senders = *@fsf.org + transport = remote_smtp_smarthost + route_list = * mail.fsf.org byname + host_find_failed = ignore + same_domain_copy_routing = yes + no_more +EOF + + # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost + # i only need .forwards, so just doing that one. + cd /etc/exim4/conf.d/router + b=userforward_higher_priority + # replace the router name so it is unique + sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b # begin setup passwd.client f=/etc/exim4/passwd.client @@ -830,39 +891,33 @@ EOF done # end setup passwd.client - # https://blog.dhampir.no/content/make-exim4-on-debian-respect-forward-and-etcaliases-when-using-a-smarthost - # i only need .forwards, so just doing that one. - cd /etc/exim4/conf.d/router - b=userforward_higher_priority - # replace the router name so it is unique - sed -r s/^\\S+:/$b:/ 600_exim4-config_userforward >175_$b systemctl restart exim4 - fi # end if exim4 +fi #### end if exim4 - # /etc/alias setup is debian specific, and - # exim config sets up an /etc/alias from root to the postmaster, which i - # config to ian, as long as there exists an entry for root, or there was - # no preexisting aliases file. based on the postinst file. postfix - # won't set up a root to $postmaster alias if it's already installed. - # Since postfix is not the greatest, just set it ourselves. - if [[ $postmaster != root ]]; then - sed -i --follow-symlinks -f - /etc/aliases </dev/null; then if [[ $HOSTNAME == $MAIL_HOST ]]; then systemctl restart radicale systemctl enable radicale + if [[ -e /etc/logrotate.d/radicale.disabled ]]; then + mv /etc/logrotate.d/radicale{.disabled,} + fi else systemctl stop radicale systemctl disable radicale + # weekly logrotate tries to restart radicale even if it's a disabled service in flidas. + if [[ -e /etc/logrotate.d/radicale ]]; then + mv /etc/logrotate.d/radicale{,.disabled} + fi fi fi +exit 0 # if I wanted the from address to be renamed and sent to a different address, # echo "sdx@localhost development@localhost" | sudo dd of=/etc/postfix/recipient_canonical